commit cfb4d0dfe329fd5a20f74c4763ddfa3cf571192a · pyrox.dev/nixpkgs

+4 -4

lib/kernel.nix

···

       8
        
         option = x:

     

       9
        
             x // { optional = true; };

     

       10
        
       

     

       11
       -
         yes      = { tristate    = "y"; };

     

       12
       -
         no       = { tristate    = "n"; };

     

       13
       -
         module   = { tristate    = "m"; };

     

       14
       -
         freeform = x: { freeform = x; };

     

       15
        
       

     

       16
        
         /*

     

       17
        
           Common patterns/legacy used in common-config/hardened/config.nix

···

       8
        
         option = x:

     

       9
        
             x // { optional = true; };

     

       10
        
       

     

       11
       +
         yes      = { tristate    = "y"; optional = false; };

     

       12
       +
         no       = { tristate    = "n"; optional = false; };

     

       13
       +
         module   = { tristate    = "m"; optional = false; };

     

       14
       +
         freeform = x: { freeform = x; optional = false; };

     

       15
        
       

     

       16
        
         /*

     

       17
        
           Common patterns/legacy used in common-config/hardened/config.nix

+3 -2

nixos/modules/system/boot/kernel_config.nix

···

       22
        
       

     

       23
        
         mergeFalseByDefault = locs: defs:

     

       24
        
           if defs == [] then abort "This case should never happen."

     

       25
       -
           else if any (x: x == false) defs then false

     

       26
        
           else true;

     

       27
        
       

     

       28
        
         kernelItem = types.submodule {

     
···

       55
        
               default = false;

     

       56
        
               description = ''

     

       57
        
                 Wether option should generate a failure when unused.

     

       0
        
       
     

       58
        
               '';

     

       59
        
             };

     

       60
        
           };

     
···

       121
        
             type = types.attrsOf kernelItem;

     

       122
        
             example = literalExample '' with lib.kernel; {

     

       123
        
               "9P_NET" = yes;

     

       124
       -
               USB = optional yes;

     

       125
        
               MMC_BLOCK_MINORS = freeform "32";

     

       126
        
             }'';

     

       127
        
             description = ''

···

       22
        
       

     

       23
        
         mergeFalseByDefault = locs: defs:

     

       24
        
           if defs == [] then abort "This case should never happen."

     

       25
       +
           else if any (x: x == false) (getValues defs) then false

     

       26
        
           else true;

     

       27
        
       

     

       28
        
         kernelItem = types.submodule {

     
···

       55
        
               default = false;

     

       56
        
               description = ''

     

       57
        
                 Wether option should generate a failure when unused.

     

       58
       +
                 Upon merging values, mandatory wins over optional.

     

       59
        
               '';

     

       60
        
             };

     

       61
        
           };

     
···

       122
        
             type = types.attrsOf kernelItem;

     

       123
        
             example = literalExample '' with lib.kernel; {

     

       124
        
               "9P_NET" = yes;

     

       125
       +
               USB = option yes;

     

       126
        
               MMC_BLOCK_MINORS = freeform "32";

     

       127
        
             }'';

     

       128
        
             description = ''

+4 -5

pkgs/os-specific/linux/kernel/common-config.nix

···

       42
        
             TIMER_STATS               = whenOlder "4.11" yes;

     

       43
        
             DEBUG_NX_TEST             = whenOlder "4.11" no;

     

       44
        
             DEBUG_STACK_USAGE         = no;

     

       45
       -
             DEBUG_STACKOVERFLOW       = mkIf (!features.grsecurity) no;

     

       46
        
             RCU_TORTURE_TEST          = no;

     

       47
        
             SCHEDSTATS                = no;

     

       48
        
             DETECT_HUNG_TASK          = yes;

     
···

       184
        
       

     

       185
        
             # needed for ss

     

       186
        
             INET_DIAG         = yes;

     

       187
       -
             INET_TCP_DIAG     = module;

     

       188
        
             INET_UDP_DIAG     = module;

     

       189
        
             INET_RAW_DIAG     = whenAtLeast "4.14" module;

     

       190
        
             INET_DIAG_DESTROY = whenAtLeast "4.9" yes;

     
···

       365
        
             CIFS_STATS        = whenOlder "4.19" yes;

     

       366
        
             CIFS_WEAK_PW_HASH = yes;

     

       367
        
             CIFS_UPCALL       = yes;

     

       368
       -
             CIFS_ACL          = yes;

     

       369
        
             CIFS_DFS_UPCALL   = yes;

     

       370
        
             CIFS_SMB2         = whenOlder "4.13" yes;

     

       371
        
       

     
···

       396
        
             DEBUG_SET_MODULE_RONX            = { optional = true; tristate = whenOlder "4.11" "y"; };

     

       397
        
             RANDOMIZE_BASE                   = option yes;

     

       398
        
             STRICT_DEVMEM                    = option yes; # Filter access to /dev/mem

     

       399
       -
             SECURITY_SELINUX_BOOTPARAM_VALUE = freeform "0"; # Disable SELinux by default

     

       400
        
             # Prevent processes from ptracing non-children processes

     

       401
        
             SECURITY_YAMA                    = option yes;

     

       402
        
             DEVKMEM                          = mkIf (!features.grsecurity) no; # Disable /dev/kmem

     
···

       709
        
             KEXEC_JUMP      = option yes;

     

       710
        
       

     

       711
        
             # Windows Logical Disk Manager (Dynamic Disk) support

     

       712
       -
             LDM_PARTITION         = yes;

     

       713
        
             LOGIRUMBLEPAD2_FF     = yes; # Logitech Rumblepad 2 force feedback

     

       714
        
             LOGO                  = no; # not needed

     

       715
        
             MEDIA_ATTACH          = yes;

···

       42
        
             TIMER_STATS               = whenOlder "4.11" yes;

     

       43
        
             DEBUG_NX_TEST             = whenOlder "4.11" no;

     

       44
        
             DEBUG_STACK_USAGE         = no;

     

       45
       +
             DEBUG_STACKOVERFLOW       = mkIf (!features.grsecurity) (option no);

     

       46
        
             RCU_TORTURE_TEST          = no;

     

       47
        
             SCHEDSTATS                = no;

     

       48
        
             DETECT_HUNG_TASK          = yes;

     
···

       184
        
       

     

       185
        
             # needed for ss

     

       186
        
             INET_DIAG         = yes;

     

       0
        
       
     

       187
        
             INET_UDP_DIAG     = module;

     

       188
        
             INET_RAW_DIAG     = whenAtLeast "4.14" module;

     

       189
        
             INET_DIAG_DESTROY = whenAtLeast "4.9" yes;

     
···

       364
        
             CIFS_STATS        = whenOlder "4.19" yes;

     

       365
        
             CIFS_WEAK_PW_HASH = yes;

     

       366
        
             CIFS_UPCALL       = yes;

     

       367
       +
             CIFS_ACL          = option yes;

     

       368
        
             CIFS_DFS_UPCALL   = yes;

     

       369
        
             CIFS_SMB2         = whenOlder "4.13" yes;

     

       370
        
       

     
···

       395
        
             DEBUG_SET_MODULE_RONX            = { optional = true; tristate = whenOlder "4.11" "y"; };

     

       396
        
             RANDOMIZE_BASE                   = option yes;

     

       397
        
             STRICT_DEVMEM                    = option yes; # Filter access to /dev/mem

     

       398
       +
             SECURITY_SELINUX_BOOTPARAM_VALUE = option (freeform "0"); # Disable SELinux by default

     

       399
        
             # Prevent processes from ptracing non-children processes

     

       400
        
             SECURITY_YAMA                    = option yes;

     

       401
        
             DEVKMEM                          = mkIf (!features.grsecurity) no; # Disable /dev/kmem

     
···

       708
        
             KEXEC_JUMP      = option yes;

     

       709
        
       

     

       710
        
             # Windows Logical Disk Manager (Dynamic Disk) support

     

       711
       +
             LDM_PARTITION         = option yes;

     

       712
        
             LOGIRUMBLEPAD2_FF     = yes; # Logitech Rumblepad 2 force feedback

     

       713
        
             LOGO                  = no; # not needed

     

       714
        
             MEDIA_ATTACH          = yes;

-3

pkgs/os-specific/linux/kernel/generic.nix

···

       158
        
               ;

     

       159
        
             }).config;

     

       160
        
       

     

       161
       -
             #

     

       162
        
             structuredConfig = moduleStructuredConfig.settings;

     

       163
        
           };

     

       164
       -
       

     

       165
       -
       

     

       166
        
         }; # end of configfile derivation

     

       167
        
       

     

       168
        
         kernel = (callPackage ./manual-config.nix {}) {

···

       158
        
               ;

     

       159
        
             }).config;

     

       160
        
       

     

       0
        
       
     

       161
        
             structuredConfig = moduleStructuredConfig.settings;

     

       162
        
           };

     

       0
        
       
     

       0
        
       
     

       163
        
         }; # end of configfile derivation

     

       164
        
       

     

       165
        
         kernel = (callPackage ./manual-config.nix {}) {

+57 -31

pkgs/test/kernel.nix

···

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       1
        
       { lib, pkgs }:

     

       2
        
       

     

       3
       -
       with lib.kernel;

     

       4
       -
       with lib.asserts;

     

       5
       -
       with lib.modules;

     

       6
        
       

     

       7
       -
       # To test nixos/modules/system/boot/kernel_config.nix;

     

       8
        
       let

     

       9
       -
         # copied from release-lib.nix

     

       10
       -
         assertTrue = bool:

     

       11
       -
           if bool

     

       12
       -
           then pkgs.runCommand "evaluated-to-true" {} "touch $out"

     

       13
       -
           else pkgs.runCommand "evaluated-to-false" {} "false";

     

       14
       -
       

     

       15
        
         lts_kernel = pkgs.linuxPackages.kernel;

     

       16
        
       

     

       17
       -
         kernelTestConfig = structuredConfig: (lts_kernel.override {

     

       18
       -
           structuredExtraConfig = structuredConfig;

     

       19
       -
         }).configfile.structuredConfig;

     

       0
        
       
     

       0
        
       
     

       20
        
       

     

       21
        
         mandatoryVsOptionalConfig = mkMerge [

     

       22
       -
           { USB_DEBUG = option yes;}

     

       23
       -
           { USB_DEBUG = yes;}

     

       24
        
         ];

     

       25
        
       

     

       26
        
         freeformConfig = mkMerge [

     

       27
       -
           { MMC_BLOCK_MINORS = freeform "32"; } # same as default, won't trigger any error

     

       28
       -
           { MMC_BLOCK_MINORS = freeform "64"; } # will trigger an error but the message is not great:

     

       29
        
         ];

     

       30
        
       

     

       31
        
         yesWinsOverNoConfig = mkMerge [

     

       32
       -
           # default for "8139TOO_PIO" is no

     

       33
       -
           { "8139TOO_PIO"  = yes; } # yes wins over no by default

     

       34
       -
           { "8139TOO_PIO"  = no; }

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       35
        
         ];

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       36
        
       in

     

       37
       -
       {

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       38
        
         # mandatory flag should win over optional

     

       39
       -
         mandatoryCheck = (kernelTestConfig mandatoryVsOptionalConfig);

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       40
        
       

     

       41
        
         # check that freeform options are unique

     

       42
        
         # Should trigger

     

       43
       -
         # > The option `settings.MMC_BLOCK_MINORS.freeform' has conflicting definitions, in `<unknown-file>' and `<unknown-file>'

     

       44
       -
         freeformCheck = let

     

       45
       -
           res = builtins.tryEval ( (kernelTestConfig freeformConfig).MMC_BLOCK_MINORS.freeform);

     

       46
       -
         in

     

       47
       -
           assertTrue (res.success == false);

     

       0
        
       
     

       0
        
       
     

       48
        
       

     

       49
       -
         yesVsNoCheck = let

     

       50
       -
           res = kernelTestConfig yesWinsOverNoConfig;

     

       51
       -
         in

     

       52
       -
           assertTrue (res."8139TOO_PIO".tristate == "y");

     

       53
        
       }

···

       1
       +
       # to run these tests:

     

       2
       +
       # nix-instantiate --eval --strict . -A tests.kernel-config

     

       3
       +
       #

     

       4
       +
       # make sure to use NON EXISTING kernel settings else they may conflict with

     

       5
       +
       # common-config.nix

     

       6
        
       { lib, pkgs }:

     

       7
        
       

     

       8
       +
       with lib;

     

       9
       +
       with kernel;

     

       0
        
       
     

       10
        
       

     

       0
        
       
     

       11
        
       let

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       12
        
         lts_kernel = pkgs.linuxPackages.kernel;

     

       13
        
       

     

       14
       +
         # to see the result once the module transformed the lose structured config

     

       15
       +
         getConfig = structuredConfig:

     

       16
       +
           (lts_kernel.override {

     

       17
       +
             structuredExtraConfig = structuredConfig;

     

       18
       +
           }).configfile.structuredConfig;

     

       19
        
       

     

       20
        
         mandatoryVsOptionalConfig = mkMerge [

     

       21
       +
           { NIXOS_FAKE_USB_DEBUG = yes;}

     

       22
       +
           { NIXOS_FAKE_USB_DEBUG = option yes; }

     

       23
        
         ];

     

       24
        
       

     

       25
        
         freeformConfig = mkMerge [

     

       26
       +
           { NIXOS_FAKE_MMC_BLOCK_MINORS = freeform "32"; } # same as default, won't trigger any error

     

       27
       +
           { NIXOS_FAKE_MMC_BLOCK_MINORS = freeform "64"; } # will trigger an error but the message is not great:

     

       28
        
         ];

     

       29
        
       

     

       30
        
         yesWinsOverNoConfig = mkMerge [

     

       31
       +
           # default for "NIXOS_TEST_BOOLEAN" is no

     

       32
       +
           { "NIXOS_TEST_BOOLEAN"  = yes; } # yes wins over no by default

     

       33
       +
           { "NIXOS_TEST_BOOLEAN"  = no; }

     

       34
       +
         ];

     

       35
       +
       

     

       36
       +
         optionalNoWins = mkMerge [

     

       37
       +
           { NIXOS_FAKE_USB_DEBUG = option yes;}

     

       38
       +
           { NIXOS_FAKE_USB_DEBUG = yes;}

     

       39
        
         ];

     

       40
       +
       

     

       41
       +
         allOptionalRemainOptional = mkMerge [

     

       42
       +
           { NIXOS_FAKE_USB_DEBUG = option yes;}

     

       43
       +
           { NIXOS_FAKE_USB_DEBUG = option yes;}

     

       44
       +
         ];

     

       45
       +
       

     

       46
        
       in

     

       47
       +
       runTests {

     

       48
       +
         testEasy = {

     

       49
       +
           expr = (getConfig { NIXOS_FAKE_USB_DEBUG = yes;}).NIXOS_FAKE_USB_DEBUG;

     

       50
       +
           expected = { tristate = "y"; optional = false; freeform = null; };

     

       51
       +
         };

     

       52
       +
       

     

       53
        
         # mandatory flag should win over optional

     

       54
       +
         testMandatoryCheck = {

     

       55
       +
           expr = (getConfig mandatoryVsOptionalConfig).NIXOS_FAKE_USB_DEBUG.optional;

     

       56
       +
           expected = false;

     

       57
       +
         };

     

       58
       +
       

     

       59
       +
         testYesWinsOverNo = {

     

       60
       +
           expr = (getConfig yesWinsOverNoConfig)."NIXOS_TEST_BOOLEAN".tristate;

     

       61
       +
           expected = "y";

     

       62
       +
         };

     

       63
       +
       

     

       64
       +
         testAllOptionalRemainOptional = {

     

       65
       +
           expr = (getConfig allOptionalRemainOptional)."NIXOS_FAKE_USB_DEBUG".optional;

     

       66
       +
           expected = true;

     

       67
       +
         };

     

       68
        
       

     

       69
        
         # check that freeform options are unique

     

       70
        
         # Should trigger

     

       71
       +
         # > The option `settings.NIXOS_FAKE_MMC_BLOCK_MINORS.freeform' has conflicting definitions, in `<unknown-file>' and `<unknown-file>'

     

       72
       +
         testTreeform = let

     

       73
       +
           res = builtins.tryEval ( (getConfig freeformConfig).NIXOS_FAKE_MMC_BLOCK_MINORS.freeform);

     

       74
       +
         in {

     

       75
       +
           expr = res.success;

     

       76
       +
           expected = false;

     

       77
       +
         };

     

       78
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       79
        
       }